From 532f7ba0da20048263fab71b04b02e0053f5ce89 Mon Sep 17 00:00:00 2001
From: Jan Benisek <benisekj@gmail.com>
Date: Sun, 10 May 2026 13:32:48 +0200
Subject: [PATCH] feat(workflows): release workflow

---
 .github/workflows/helm-release.yml | 65 ++++++++++++++++++++++++++++++
 README.md                          | 36 +++++++----------
 2 files changed, 79 insertions(+), 22 deletions(-)
 create mode 100644 .github/workflows/helm-release.yml

diff --git a/.github/workflows/helm-release.yml b/.github/workflows/helm-release.yml
new file mode 100644
index 0000000..8a6af75
--- /dev/null
+++ b/.github/workflows/helm-release.yml
@@ -0,0 +1,65 @@
+# .github/workflows/helm-release.yml
+name: Release Helm Chart
+
+on:
+  push:
+    tags:
+      - 'filebrowser-quantum-v*'   # only triggers on tags like filebrowser-quantum-v1.2.3
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      packages: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # needed for git-cliff changelog range
+
+      - name: Extract version from tag
+        id: version
+        run: |
+          # strips "filebrowser-quantum-v" prefix → "1.2.3"
+          VERSION=${GITHUB_REF_NAME#filebrowser-quantum-v}
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+
+      - name: Lint chart
+        run: helm lint filebrowser
+
+      - name: Generate changelog
+        id: changelog
+        uses: orhun/git-cliff-action@v4
+        with:
+          args: --latest --strip header
+        env:
+          OUTPUT: CHANGELOG.md
+          GITHUB_REPO: ${{ github.repository }}
+
+      - name: Update Chart.yaml version
+        run: |
+          sed -i "s/^version:.*/version: ${{ steps.version.outputs.version }}/" filebrowser/Chart.yaml
+
+      - name: Login to GHCR
+        run: |
+          echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io \
+            -u ${{ github.actor }} --password-stdin
+
+      - name: Package and push chart
+        run: |
+          helm package filebrowser --version ${{ steps.version.outputs.version }}
+          helm push filebrowser-quantum-${{ steps.version.outputs.version }}.tgz \
+            oci://ghcr.io/${{ github.repository_owner }}/helm-charts
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: ${{ github.ref_name }}
+          name: "filebrowser-quantum v${{ steps.version.outputs.version }}"
+          body: ${{ steps.changelog.outputs.content }}
+          files: filebrowser-quantum-${{ steps.version.outputs.version }}.tgz
diff --git a/README.md b/README.md
index 9a7774e..abf7c3d 100644
--- a/README.md
+++ b/README.md
@@ -24,6 +24,18 @@ If you require commercial support, consulting, or custom solutions, please feel
 - Sufficent resources
 - Helm3
 
+## Quick Start
+
+Install the chart directly from the GitHub Container Registry (OCI):
+
+```bash
+helm upgrade --install filebrowser \
+  oci://ghcr.io/softwaredam/helm-charts/filebrowser-quantum \
+  --namespace filebrowser \
+  --create-namespace \
+  --values filebrowser-values.yaml
+```
+
 ## Configuration
 
 This chart supports multiple ways to prepare your deployment configuration. See `values.yaml` for all the possibilities. 
@@ -34,12 +46,9 @@ Filebrowser Quantum requires a `config.yaml` for application configuration. This
 ### Admin password
 After each upgrade/deploy, a new password will be generated for the admin user. This is intentional to keep the admin password rolling. the default admin password can be overridden (not recommended) through config. 
 
-To get the password, use the following for ease:
+To get the password, use the following:
 ```bash
-export FILEBROWSER_NAMESPACE="filebrowser"
-export RELEASE_NAME="share"
-
-kubectl -n "${FILEBROWSER_NAMESPACE}"  get secrets ${RELEASE_NAME}-filebrowser-quantum -oyaml | yq '.data.FILEBROWSER_ADMIN_PASSWORD' | base64 -d | pbcopy
+kubectl -n filebrowser get secrets filebrowser-filebrowser-quantum -oyaml | yq '.data.FILEBROWSER_ADMIN_PASSWORD' | base64 -d | pbcopy
 ```
 
 ### Other secrets
@@ -113,23 +122,6 @@ extraEnvSecrets:
     FILEBROWSER_OIDC_CLIENT_SECRET: the-oidc-client-secret
 ```
 
-## Deployment
-
-Use `helm` to install, like:
-
-```bash
-export FILEBROWSER_NAMESPACE="filebrowser"
-export RELEASE_NAME="share"
-
-helm upgrade --install \
-     --namespace="${FILEBROWSER_NAMESPACE}" \
-     --create-namespace \
-     "${RELEASE_NAME}" \
-     filebrowser \
-     --values filebrowser-values.yaml \
-     --values decrypted-sops-secrets.yaml
-```
-
 ## Kubernetes objects
 
 This chart will create the following objects: